Bug 41584 - Don't ask for 2FA OTP after SSO login
Summary: Don't ask for 2FA OTP after SSO login
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-01-09 14:03 UTC by Magnus Enger
Modified: 2026-01-11 23:51 UTC (History)
2 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Magnus Enger 2026-01-09 14:03:51 UTC
We have a setup where 2FA = Enforce, and Shibboleth is enabled. 

When users choose the SSO login they are redirected to the idP, sign in there and are then return to Koha. But when they are returned to Koha they are asked to provide the 2FA OTP. If they do not have 2FA set up for their account they get a blue box with information about how to set it up, and a key/QR-code. 

I am not sure if this happens by accident or design, but it seems to me that signing in with the idP should be enough, and Koha should not ask for further "credentials". I might be wrong, though. :-)
Comment 1 David Cook 2026-01-11 23:51:03 UTC
Yeah, this is an interesting point.

I can understand wanting to enforce 2FA/MFA on local logins but not SSO because your SSO Identity Provider might be enforcing 2FA/MFA on that end.

I suppose there are Koha setups where people might want the 2FA/MFA on local logins and SSO though, so maybe we do need more options?
Comment 2 David Cook 2026-01-11 23:51:43 UTC
(In reply to David Cook from comment #1)
> so maybe we do need more options?

*hides from all the objects people might throw at him for suggesting more options/preferences*